@atproto-labs/handle-resolver-node 0.0.1 → 0.1.1

package/CHANGELOG.md

@@ -1,13 +1,23 @@
 # @atproto-labs/handle-resolver-node
 
-## 0.0.1
+## 0.1.1
 
 ### Patch Changes
 
-- [`e134c79a0`](https://github.com/bluesky-social/atproto/commit/e134c79a0ffb000b2cb36437815673fa6bda664b) Thanks [@devinivy](https://github.com/devinivy)! - Initial publish of experimental oauth packages to @atproto-labs
+- [#2633](https://github.com/bluesky-social/atproto/pull/2633) [`acc9093d2`](https://github.com/bluesky-social/atproto/commit/acc9093d2845eba02b68fb2f9db33e4f1b59bb10) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Use distinct type names to prevent conflicts
 
-- Updated dependencies [[`e134c79a0`](https://github.com/bluesky-social/atproto/commit/e134c79a0ffb000b2cb36437815673fa6bda664b)]:
-  - @atproto-labs/handle-resolver@0.0.1
-  - @atproto-labs/fetch-node@0.0.1
-  - @atproto-labs/fetch@0.0.1
-  - @atproto-labs/did@0.0.1
+- Updated dependencies [[`acc9093d2`](https://github.com/bluesky-social/atproto/commit/acc9093d2845eba02b68fb2f9db33e4f1b59bb10)]:
+  - @atproto-labs/handle-resolver@0.1.1
+
+## 0.1.0
+
+### Minor Changes
+
+- [#2482](https://github.com/bluesky-social/atproto/pull/2482) [`a8d6c1123`](https://github.com/bluesky-social/atproto/commit/a8d6c112359f5c4c0cfbe2df63443ed275f2a646) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add OAuth provider capability & support for DPoP signed tokens
+
+### Patch Changes
+
+- Updated dependencies [[`a8d6c1123`](https://github.com/bluesky-social/atproto/commit/a8d6c112359f5c4c0cfbe2df63443ed275f2a646)]:
+  - @atproto-labs/handle-resolver@0.1.0
+  - @atproto-labs/fetch-node@0.1.0
+  - @atproto/did@0.1.0

package/dist/atproto-handle-resolver-node.d.ts

@@ -0,0 +1,22 @@
+import { Fetch } from '@atproto-labs/fetch-node';
+import { AtprotoHandleResolver, HandleResolver } from '@atproto-labs/handle-resolver';
+export type AtprotoHandleResolverNodeOptions = {
+    /**
+     * List of backup nameservers to use in case the primary ones fail. Will
+     * default to no fallback nameservers.
+     */
+    fallbackNameservers?: string[];
+    /**
+     * Fetch function to use for HTTP requests. Allows customizing the request
+     * behavior, e.g. adding headers, setting a timeout, mocking, etc. The
+     * provided fetch function will be wrapped with a safeFetchWrap function that
+     * adds SSRF protection.
+     *
+     * @default `globalThis.fetch`
+     */
+    fetch?: Fetch;
+};
+export declare class AtprotoHandleResolverNode extends AtprotoHandleResolver implements HandleResolver {
+    constructor({ fetch, fallbackNameservers, }?: AtprotoHandleResolverNodeOptions);
+}
+//# sourceMappingURL=atproto-handle-resolver-node.d.ts.map

package/dist/atproto-handle-resolver-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atproto-handle-resolver-node.d.ts","sourceRoot":"","sources":["../src/atproto-handle-resolver-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAiB,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EACL,qBAAqB,EACrB,cAAc,EACf,MAAM,+BAA+B,CAAA;AAOtC,MAAM,MAAM,gCAAgC,GAAG;IAC7C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE9B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,yBACX,SAAQ,qBACR,YAAW,cAAc;gBAEb,EACV,KAAwB,EACxB,mBAAmB,GACpB,GAAE,gCAAqC;CAczC"}

package/dist/atproto-handle-resolver-node.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AtprotoHandleResolverNode = void 0;
+const fetch_node_1 = require("@atproto-labs/fetch-node");
+const handle_resolver_1 = require("@atproto-labs/handle-resolver");
+const node_resolve_txt_factory_js_1 = require("./node-resolve-txt-factory.js");
+class AtprotoHandleResolverNode extends handle_resolver_1.AtprotoHandleResolver {
+    constructor({ fetch = globalThis.fetch, fallbackNameservers, } = {}) {
+        super({
+            fetch: (0, fetch_node_1.safeFetchWrap)({
+                fetch,
+                timeout: 3000, // 3 seconds
+                ssrfProtection: true,
+                responseMaxSize: 10 * 1048, // DID are max 2048 characters, 10kb for safety
+            }),
+            resolveTxt: node_resolve_txt_factory_js_1.nodeResolveTxtDefault,
+            resolveTxtFallback: fallbackNameservers?.length
+                ? (0, node_resolve_txt_factory_js_1.nodeResolveTxtFactory)(fallbackNameservers)
+                : undefined,
+        });
+    }
+}
+exports.AtprotoHandleResolverNode = AtprotoHandleResolverNode;
+//# sourceMappingURL=atproto-handle-resolver-node.js.map

package/dist/atproto-handle-resolver-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atproto-handle-resolver-node.js","sourceRoot":"","sources":["../src/atproto-handle-resolver-node.ts"],"names":[],"mappings":";;;AAAA,yDAA+D;AAC/D,mEAGsC;AAEtC,+EAGsC;AAoBtC,MAAa,yBACX,SAAQ,uCAAqB;IAG7B,YAAY,EACV,KAAK,GAAG,UAAU,CAAC,KAAK,EACxB,mBAAmB,MACiB,EAAE;QACtC,KAAK,CAAC;YACJ,KAAK,EAAE,IAAA,0BAAa,EAAC;gBACnB,KAAK;gBACL,OAAO,EAAE,IAAI,EAAE,YAAY;gBAC3B,cAAc,EAAE,IAAI;gBACpB,eAAe,EAAE,EAAE,GAAG,IAAI,EAAE,+CAA+C;aAC5E,CAAC;YACF,UAAU,EAAE,mDAAqB;YACjC,kBAAkB,EAAE,mBAAmB,EAAE,MAAM;gBAC7C,CAAC,CAAC,IAAA,mDAAqB,EAAC,mBAAmB,CAAC;gBAC5C,CAAC,CAAC,SAAS;SACd,CAAC,CAAA;IACJ,CAAC;CACF;AArBD,8DAqBC"}

package/dist/index.d.ts

@@ -1,4 +1,2 @@
-export * from './node-handle-resolver.js';
-export { NodeHandleResolver as default } from './node-handle-resolver.js';
-export * from './dns-handle-resolver.js';
+export * from './atproto-handle-resolver-node.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,2BAA2B,CAAA;AACzC,OAAO,EAAE,kBAAkB,IAAI,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAGzE,cAAc,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAA"}

package/dist/index.js

@@ -14,11 +14,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = void 0;
-// Main export
-__exportStar(require("./node-handle-resolver.js"), exports);
-var node_handle_resolver_js_1 = require("./node-handle-resolver.js");
-Object.defineProperty(exports, "default", { enumerable: true, get: function () { return node_handle_resolver_js_1.NodeHandleResolver; } });
-// Utilities
-__exportStar(require("./dns-handle-resolver.js"), exports);
+__exportStar(require("./atproto-handle-resolver-node.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,cAAc;AACd,4DAAyC;AACzC,qEAAyE;AAAhE,kHAAA,kBAAkB,OAAW;AAEtC,YAAY;AACZ,2DAAwC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oEAAiD"}

package/dist/node-resolve-txt-factory.d.ts

@@ -0,0 +1,4 @@
+import { ResolveTxt } from '@atproto-labs/handle-resolver';
+export declare const nodeResolveTxtDefault: ResolveTxt;
+export declare function nodeResolveTxtFactory(nameservers: string[]): ResolveTxt;
+//# sourceMappingURL=node-resolve-txt-factory.d.ts.map

package/dist/node-resolve-txt-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-resolve-txt-factory.d.ts","sourceRoot":"","sources":["../src/node-resolve-txt-factory.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAE1D,eAAO,MAAM,qBAAqB,EAAE,UACiB,CAAA;AAErD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,UAAU,CA0CvE"}

package/dist/node-resolve-txt-factory.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeResolveTxtFactory = exports.nodeResolveTxtDefault = void 0;
+const promises_1 = require("node:dns/promises");
+const node_net_1 = require("node:net");
+const nodeResolveTxtDefault = (hostname) => (0, promises_1.resolveTxt)(hostname).then(groupChunks, handleError);
+exports.nodeResolveTxtDefault = nodeResolveTxtDefault;
+function nodeResolveTxtFactory(nameservers) {
+    // Optimization
+    if (!nameservers.length)
+        return async () => null;
+    // Build the resolver asynchronously (will be awaited on every use)
+    const resolverPromise = Promise.all(nameservers.map((nameserver) => {
+        const [domain, port = null] = nameserver.split(':', 2);
+        if (port !== null && !/^\d+$/.test(port)) {
+            throw new TypeError(`Invalid name server "${nameserver}"`);
+        }
+        return (0, node_net_1.isIP)(domain) === 4 || isBracedIPv6(domain)
+            ? [nameserver] // No need to lookup
+            : (0, promises_1.lookup)(domain, { all: true }).then((r) => r.map((a) => appendPort(a.address, port)), 
+            // Let's just ignore failed nameservers resolution
+            (_err) => []);
+    })).then((results) => {
+        const backupIps = results.flat(1);
+        // No resolver if no valid IP
+        if (!backupIps.length)
+            return null;
+        const resolver = new promises_1.Resolver();
+        resolver.setServers(backupIps);
+        return resolver;
+    });
+    // Avoid uncaught promise rejection
+    void resolverPromise.catch(() => {
+        // Should never happen though...
+    });
+    return async (hostname) => {
+        const resolver = await resolverPromise;
+        return resolver
+            ? resolver.resolveTxt(hostname).then(groupChunks, handleError)
+            : null;
+    };
+}
+exports.nodeResolveTxtFactory = nodeResolveTxtFactory;
+function isBracedIPv6(address) {
+    return (address.startsWith('[') &&
+        address.endsWith(']') &&
+        (0, node_net_1.isIP)(address.slice(1, -1)) === 6);
+}
+function groupChunks(results) {
+    return results.map((chunks) => chunks.join(''));
+}
+function handleError(err) {
+    // Invalid argument type (e.g. hostname is a number)
+    if (err instanceof TypeError)
+        throw err;
+    // If the hostname does not resolve, return null
+    if (err instanceof Error) {
+        if (err['code'] === 'ENOTFOUND')
+            return null;
+        // Hostname is not a valid domain name
+        if (err['code'] === 'EBADNAME')
+            throw err;
+        // DNS server unreachable
+        // if (err['code'] === 'ETIMEOUT') throw err
+    }
+    // Historically, errors were not thrown here. A "null" value indicates to the
+    // AtprotoHandleResolver that it should try the fallback resolver.
+    // @TODO We might want to re-visit this to only apply when an unexpected error
+    // occurs (by throwing here). For now, let's keep the same behavior as before.
+    // throw err
+    return null;
+}
+function appendPort(address, port) {
+    switch ((0, node_net_1.isIP)(address)) {
+        case 4:
+            return port ? `${address}:${port}` : address;
+        case 6:
+            return port ? `[${address}]:${port}` : `[${address}]`;
+        default:
+            throw new TypeError(`Invalid IP address "${address}"`);
+    }
+}
+//# sourceMappingURL=node-resolve-txt-factory.js.map

package/dist/node-resolve-txt-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-resolve-txt-factory.js","sourceRoot":"","sources":["../src/node-resolve-txt-factory.ts"],"names":[],"mappings":";;;AAAA,gDAAgE;AAChE,uCAA+B;AAIxB,MAAM,qBAAqB,GAAe,CAAC,QAAQ,EAAE,EAAE,CAC5D,IAAA,qBAAU,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;AADxC,QAAA,qBAAqB,yBACmB;AAErD,SAAgB,qBAAqB,CAAC,WAAqB;IACzD,eAAe;IACf,IAAI,CAAC,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAA;IAEhD,mEAAmE;IACnE,MAAM,eAAe,GAA6B,OAAO,CAAC,GAAG,CAC3D,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAC7B,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAEtD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CAAC,wBAAwB,UAAU,GAAG,CAAC,CAAA;QAC5D,CAAC;QAED,OAAO,IAAA,eAAI,EAAC,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC;YAC/C,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,oBAAoB;YACnC,CAAC,CAAC,IAAA,iBAAM,EAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChD,kDAAkD;YAClD,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CACb,CAAA;IACP,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjC,6BAA6B;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAElC,MAAM,QAAQ,GAAG,IAAI,mBAAQ,EAAE,CAAA;QAC/B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAC9B,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,mCAAmC;IACnC,KAAK,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE;QAC9B,gCAAgC;IAClC,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAA;QACtC,OAAO,QAAQ;YACb,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAA;IACV,CAAC,CAAA;AACH,CAAC;AA1CD,sDA0CC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,IAAA,eAAI,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACjC,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,oDAAoD;IACpD,IAAI,GAAG,YAAY,SAAS;QAAE,MAAM,GAAG,CAAA;IAEvC,gDAAgD;IAChD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,WAAW;YAAE,OAAO,IAAI,CAAA;QAE5C,sCAAsC;QACtC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;YAAE,MAAM,GAAG,CAAA;QAEzC,yBAAyB;QACzB,4CAA4C;IAC9C,CAAC;IAED,6EAA6E;IAC7E,kEAAkE;IAElE,8EAA8E;IAC9E,8EAA8E;IAE9E,YAAY;IAEZ,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAmB;IACtD,QAAQ,IAAA,eAAI,EAAC,OAAO,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC;YACJ,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QAC9C,KAAK,CAAC;YACJ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAA;QACvD;YACE,MAAM,IAAI,SAAS,CAAC,uBAAuB,OAAO,GAAG,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto-labs/handle-resolver-node",
-  "version": "0.0.1",
+  "version": "0.1.1",
   "license": "MIT",
   "description": "Node specific ATProto handle to DID resolver",
   "keywords": [
@@ -14,7 +14,7 @@
   "repository": {
     "type": "git",
     "url": "https://github.com/bluesky-social/atproto",
-    "directory": "packages/handle-resolver-node"
+    "directory": "packages/internal/handle-resolver-node"
   },
   "type": "commonjs",
   "main": "dist/index.js",
@@ -26,10 +26,9 @@
     }
   },
   "dependencies": {
-    "@atproto-labs/handle-resolver": "0.0.1",
-    "@atproto-labs/fetch": "0.0.1",
-    "@atproto-labs/fetch-node": "0.0.1",
-    "@atproto-labs/did": "0.0.1"
+    "@atproto-labs/fetch-node": "0.1.0",
+    "@atproto-labs/handle-resolver": "0.1.1",
+    "@atproto/did": "0.1.0"
   },
   "devDependencies": {
     "typescript": "^5.3.3"

package/src/atproto-handle-resolver-node.ts

@@ -0,0 +1,51 @@
+import { Fetch, safeFetchWrap } from '@atproto-labs/fetch-node'
+import {
+  AtprotoHandleResolver,
+  HandleResolver,
+} from '@atproto-labs/handle-resolver'
+
+import {
+  nodeResolveTxtDefault,
+  nodeResolveTxtFactory,
+} from './node-resolve-txt-factory.js'
+
+export type AtprotoHandleResolverNodeOptions = {
+  /**
+   * List of backup nameservers to use in case the primary ones fail. Will
+   * default to no fallback nameservers.
+   */
+  fallbackNameservers?: string[]
+
+  /**
+   * Fetch function to use for HTTP requests. Allows customizing the request
+   * behavior, e.g. adding headers, setting a timeout, mocking, etc. The
+   * provided fetch function will be wrapped with a safeFetchWrap function that
+   * adds SSRF protection.
+   *
+   * @default `globalThis.fetch`
+   */
+  fetch?: Fetch
+}
+
+export class AtprotoHandleResolverNode
+  extends AtprotoHandleResolver
+  implements HandleResolver
+{
+  constructor({
+    fetch = globalThis.fetch,
+    fallbackNameservers,
+  }: AtprotoHandleResolverNodeOptions = {}) {
+    super({
+      fetch: safeFetchWrap({
+        fetch,
+        timeout: 3000, // 3 seconds
+        ssrfProtection: true,
+        responseMaxSize: 10 * 1048, // DID are max 2048 characters, 10kb for safety
+      }),
+      resolveTxt: nodeResolveTxtDefault,
+      resolveTxtFallback: fallbackNameservers?.length
+        ? nodeResolveTxtFactory(fallbackNameservers)
+        : undefined,
+    })
+  }
+}

package/src/index.ts

@@ -1,6 +1 @@
-// Main export
-export * from './node-handle-resolver.js'
-export { NodeHandleResolver as default } from './node-handle-resolver.js'
-
-// Utilities
-export * from './dns-handle-resolver.js'
+export * from './atproto-handle-resolver-node.js'

package/src/node-resolve-txt-factory.ts

@@ -0,0 +1,100 @@
+import { Resolver, lookup, resolveTxt } from 'node:dns/promises'
+import { isIP } from 'node:net'
+
+import { ResolveTxt } from '@atproto-labs/handle-resolver'
+
+export const nodeResolveTxtDefault: ResolveTxt = (hostname) =>
+  resolveTxt(hostname).then(groupChunks, handleError)
+
+export function nodeResolveTxtFactory(nameservers: string[]): ResolveTxt {
+  // Optimization
+  if (!nameservers.length) return async () => null
+
+  // Build the resolver asynchronously (will be awaited on every use)
+  const resolverPromise: Promise<Resolver | null> = Promise.all<string[]>(
+    nameservers.map((nameserver) => {
+      const [domain, port = null] = nameserver.split(':', 2)
+
+      if (port !== null && !/^\d+$/.test(port)) {
+        throw new TypeError(`Invalid name server "${nameserver}"`)
+      }
+
+      return isIP(domain) === 4 || isBracedIPv6(domain)
+        ? [nameserver] // No need to lookup
+        : lookup(domain, { all: true }).then(
+            (r) => r.map((a) => appendPort(a.address, port)),
+            // Let's just ignore failed nameservers resolution
+            (_err) => [],
+          )
+    }),
+  ).then((results) => {
+    const backupIps = results.flat(1)
+    // No resolver if no valid IP
+    if (!backupIps.length) return null
+
+    const resolver = new Resolver()
+    resolver.setServers(backupIps)
+    return resolver
+  })
+
+  // Avoid uncaught promise rejection
+  void resolverPromise.catch(() => {
+    // Should never happen though...
+  })
+
+  return async (hostname) => {
+    const resolver = await resolverPromise
+    return resolver
+      ? resolver.resolveTxt(hostname).then(groupChunks, handleError)
+      : null
+  }
+}
+
+function isBracedIPv6(address: string): boolean {
+  return (
+    address.startsWith('[') &&
+    address.endsWith(']') &&
+    isIP(address.slice(1, -1)) === 6
+  )
+}
+
+function groupChunks(results: string[][]): string[] {
+  return results.map((chunks) => chunks.join(''))
+}
+
+function handleError(err: unknown) {
+  // Invalid argument type (e.g. hostname is a number)
+  if (err instanceof TypeError) throw err
+
+  // If the hostname does not resolve, return null
+  if (err instanceof Error) {
+    if (err['code'] === 'ENOTFOUND') return null
+
+    // Hostname is not a valid domain name
+    if (err['code'] === 'EBADNAME') throw err
+
+    // DNS server unreachable
+    // if (err['code'] === 'ETIMEOUT') throw err
+  }
+
+  // Historically, errors were not thrown here. A "null" value indicates to the
+  // AtprotoHandleResolver that it should try the fallback resolver.
+
+  // @TODO We might want to re-visit this to only apply when an unexpected error
+  // occurs (by throwing here). For now, let's keep the same behavior as before.
+
+  // throw err
+
+  return null
+}
+
+function appendPort(address: string, port: string | null): string {
+  switch (isIP(address)) {
+    case 4:
+      return port ? `${address}:${port}` : address
+    case 6:
+      return port ? `[${address}]:${port}` : `[${address}]`
+    default:
+      throw new TypeError(`Invalid IP address "${address}"`)
+  }
+}

package/tsconfig.build.json

@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig/node.json",
+  "extends": ["../../../tsconfig/node.json"],
   "compilerOptions": {
     "rootDir": "./src",
     "outDir": "./dist"

package/dist/dns-handle-resolver.d.ts

@@ -1,15 +0,0 @@
-/// <reference types="node" />
-import { resolveTxt } from 'node:dns/promises';
-import { HandleResolveOptions, HandleResolver, ResolvedHandle } from '@atproto-labs/handle-resolver';
-export type DnsHandleResolverOptions = {
-    /**
-     * Nameservers to use in place of the system's default nameservers.
-     */
-    nameservers?: string[];
-};
-export declare class DnsHandleResolver implements HandleResolver {
-    protected resolveTxt: typeof resolveTxt;
-    constructor(options?: DnsHandleResolverOptions);
-    resolve(handle: string, _options?: HandleResolveOptions): Promise<ResolvedHandle>;
-}
-//# sourceMappingURL=dns-handle-resolver.d.ts.map

package/dist/dns-handle-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dns-handle-resolver.d.ts","sourceRoot":"","sources":["../src/dns-handle-resolver.ts"],"names":[],"mappings":";AAAA,OAAO,EAAoB,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,cAAc,EAEf,MAAM,+BAA+B,CAAA;AAKtC,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB,CAAA;AAED,qBAAa,iBAAkB,YAAW,cAAc;IACtD,SAAS,CAAC,UAAU,EAAE,OAAO,UAAU,CAAA;gBAE3B,OAAO,CAAC,EAAE,wBAAwB;IAMjC,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,oBAAoB,GAC9B,OAAO,CAAC,cAAc,CAAC;CAO3B"}

package/dist/dns-handle-resolver.js

@@ -1,58 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DnsHandleResolver = void 0;
-const promises_1 = require("node:dns/promises");
-const handle_resolver_1 = require("@atproto-labs/handle-resolver");
-const SUBDOMAIN = '_atproto';
-const PREFIX = 'did=';
-class DnsHandleResolver {
-    constructor(options) {
-        Object.defineProperty(this, "resolveTxt", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        this.resolveTxt = options?.nameservers
-            ? buildResolveTxt(options.nameservers)
-            : promises_1.resolveTxt.bind(null);
-    }
-    async resolve(handle, _options) {
-        try {
-            return parseDnsResult(await this.resolveTxt(`${SUBDOMAIN}.${handle}`));
-        }
-        catch (err) {
-            return null;
-        }
-    }
-}
-exports.DnsHandleResolver = DnsHandleResolver;
-function buildResolveTxt(nameservers) {
-    // Build the resolver asynchronously
-    const resolverPromise = Promise.allSettled(nameservers.map((h) => (0, promises_1.lookup)(h)))
-        .then((responses) => responses.flatMap((r) => r.status === 'fulfilled' ? [r.value.address] : []))
-        .then((backupIps) => {
-        if (!backupIps.length)
-            return null;
-        const resolver = new promises_1.Resolver();
-        resolver.setServers(backupIps);
-        return resolver;
-    });
-    resolverPromise.catch(() => {
-        // Should never happen
-    });
-    return async (hostname) => {
-        const resolver = await resolverPromise;
-        return resolver ? resolver.resolveTxt(hostname) : [];
-    };
-}
-function parseDnsResult(chunkedResults) {
-    const results = chunkedResults.map((chunks) => chunks.join(''));
-    const found = results.filter((i) => i.startsWith(PREFIX));
-    if (found.length !== 1) {
-        return null;
-    }
-    const did = found[0].slice(PREFIX.length);
-    return (0, handle_resolver_1.isResolvedHandle)(did) ? did : null;
-}
-//# sourceMappingURL=dns-handle-resolver.js.map

package/dist/dns-handle-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dns-handle-resolver.js","sourceRoot":"","sources":["../src/dns-handle-resolver.ts"],"names":[],"mappings":";;;AAAA,gDAAgE;AAEhE,mEAKsC;AAEtC,MAAM,SAAS,GAAG,UAAU,CAAA;AAC5B,MAAM,MAAM,GAAG,MAAM,CAAA;AASrB,MAAa,iBAAiB;IAG5B,YAAY,OAAkC;QAFpC;;;;;WAA6B;QAGrC,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,WAAW;YACpC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC;YACtC,CAAC,CAAC,qBAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,MAAc,EACd,QAA+B;QAE/B,IAAI,CAAC;YACH,OAAO,cAAc,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF;AAnBD,8CAmBC;AAED,SAAS,eAAe,CAAC,WAAqB;IAC5C,oCAAoC;IACpC,MAAM,eAAe,GAA6B,OAAO,CAAC,UAAU,CAClE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAM,EAAC,CAAC,CAAC,CAAC,CAClC;SACE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAClB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAClD,CACF;SACA,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAClB,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,mBAAQ,EAAE,CAAA;QAC/B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAC9B,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;IAEJ,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE;QACzB,sBAAsB;IACxB,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAA;QACtC,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,CAAC,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,cAA0B;IAChD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,OAAO,IAAA,kCAAgB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAC3C,CAAC"}

package/dist/node-handle-resolver.d.ts

@@ -1,29 +0,0 @@
-import { Fetch } from '@atproto-labs/fetch';
-import { SafeFetchWrapOptions } from '@atproto-labs/fetch-node';
-import { CachedHandleResolver, CachedHandleResolverOptions, HandleResolver } from '@atproto-labs/handle-resolver';
-import { DnsHandleResolverOptions } from './dns-handle-resolver.js';
-export type NodeHandleResolverOptions = {
-    /**
-     * List of domain names that are forbidden to be resolved using the
-     * well-known/atproto-did method.
-     */
-    wellKnownExclude?: SafeFetchWrapOptions['forbiddenDomainNames'];
-    /**
-     * List of backup nameservers to use for DNS resolution.
-     */
-    fallbackNameservers?: DnsHandleResolverOptions['nameservers'];
-    cache?: CachedHandleResolverOptions['cache'];
-    /**
-     * Fetch function to use for HTTP requests. Allows customizing the request
-     * behavior, e.g. adding headers, setting a timeout, mocking, etc. The
-     * provided fetch function will be wrapped with a safeFetchWrap function that
-     * adds SSRF protection.
-     *
-     * @default `globalThis.fetch`
-     */
-    fetch?: Fetch;
-};
-export declare class NodeHandleResolver extends CachedHandleResolver implements HandleResolver {
-    constructor({ cache, fetch, fallbackNameservers, wellKnownExclude, }?: NodeHandleResolverOptions);
-}
-//# sourceMappingURL=node-handle-resolver.d.ts.map

package/dist/node-handle-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"node-handle-resolver.d.ts","sourceRoot":"","sources":["../src/node-handle-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAiB,MAAM,0BAA0B,CAAA;AAC9E,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,EAEf,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAEL,wBAAwB,EACzB,MAAM,0BAA0B,CAAA;AAEjC,MAAM,MAAM,yBAAyB,GAAG;IACtC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;IAE/D;;OAEG;IACH,mBAAmB,CAAC,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAA;IAE7D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAA;IAE5C;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,kBACX,SAAQ,oBACR,YAAW,cAAc;gBAEb,EACV,KAAK,EACL,KAAwB,EACxB,mBAAmB,EACnB,gBAAgB,GACjB,GAAE,yBAA8B;CA+ClC"}

package/dist/node-handle-resolver.js

@@ -1,49 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NodeHandleResolver = void 0;
-const fetch_node_1 = require("@atproto-labs/fetch-node");
-const handle_resolver_1 = require("@atproto-labs/handle-resolver");
-const dns_handle_resolver_js_1 = require("./dns-handle-resolver.js");
-class NodeHandleResolver extends handle_resolver_1.CachedHandleResolver {
-    constructor({ cache, fetch = globalThis.fetch, fallbackNameservers, wellKnownExclude, } = {}) {
-        const safeFetch = (0, fetch_node_1.safeFetchWrap)({
-            fetch,
-            timeout: 3000, // 3 seconds
-            forbiddenDomainNames: wellKnownExclude,
-            ssrfProtection: true,
-            responseMaxSize: 10 * 1048, // DID are max 2048 characters, 10kb for safety
-        });
-        const httpResolver = new handle_resolver_1.WellKnownHandleResolver({
-            fetch: safeFetch,
-        });
-        const dnsResolver = new dns_handle_resolver_js_1.DnsHandleResolver();
-        const fallbackResolver = new dns_handle_resolver_js_1.DnsHandleResolver({
-            nameservers: fallbackNameservers,
-        });
-        super({
-            cache,
-            resolver: {
-                resolve: async (handle) => {
-                    const abortController = new AbortController();
-                    const dnsPromise = dnsResolver.resolve(handle);
-                    const httpPromise = httpResolver.resolve(handle, {
-                        signal: abortController.signal,
-                    });
-                    // Will be awaited later
-                    httpPromise.catch(() => { });
-                    const dnsRes = await dnsPromise;
-                    if (dnsRes) {
-                        abortController.abort();
-                        return dnsRes;
-                    }
-                    const res = await httpPromise;
-                    if (res)
-                        return res;
-                    return fallbackResolver.resolve(handle);
-                },
-            },
-        });
-    }
-}
-exports.NodeHandleResolver = NodeHandleResolver;
-//# sourceMappingURL=node-handle-resolver.js.map

package/dist/node-handle-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"node-handle-resolver.js","sourceRoot":"","sources":["../src/node-handle-resolver.ts"],"names":[],"mappings":";;;AACA,yDAA8E;AAC9E,mEAKsC;AAEtC,qEAGiC;AA2BjC,MAAa,kBACX,SAAQ,sCAAoB;IAG5B,YAAY,EACV,KAAK,EACL,KAAK,GAAG,UAAU,CAAC,KAAK,EACxB,mBAAmB,EACnB,gBAAgB,MACa,EAAE;QAC/B,MAAM,SAAS,GAAG,IAAA,0BAAa,EAAC;YAC9B,KAAK;YACL,OAAO,EAAE,IAAI,EAAE,YAAY;YAC3B,oBAAoB,EAAE,gBAAgB;YACtC,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,EAAE,GAAG,IAAI,EAAE,+CAA+C;SAC5E,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,IAAI,yCAAuB,CAAC;YAC/C,KAAK,EAAE,SAAS;SACjB,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,IAAI,0CAAiB,EAAE,CAAA;QAE3C,MAAM,gBAAgB,GAAG,IAAI,0CAAiB,CAAC;YAC7C,WAAW,EAAE,mBAAmB;SACjC,CAAC,CAAA;QAEF,KAAK,CAAC;YACJ,KAAK;YACL,QAAQ,EAAE;gBACR,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACxB,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA;oBAE7C,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;oBAC9C,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE;wBAC/C,MAAM,EAAE,eAAe,CAAC,MAAM;qBAC/B,CAAC,CAAA;oBAEF,wBAAwB;oBACxB,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAE3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAA;oBAC/B,IAAI,MAAM,EAAE,CAAC;wBACX,eAAe,CAAC,KAAK,EAAE,CAAA;wBACvB,OAAO,MAAM,CAAA;oBACf,CAAC;oBAED,MAAM,GAAG,GAAG,MAAM,WAAW,CAAA;oBAC7B,IAAI,GAAG;wBAAE,OAAO,GAAG,CAAA;oBAEnB,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACzC,CAAC;aACF;SACF,CAAC,CAAA;IACJ,CAAC;CACF;AAxDD,gDAwDC"}

package/src/dns-handle-resolver.ts

@@ -1,76 +0,0 @@
-import { Resolver, lookup, resolveTxt } from 'node:dns/promises'
-
-import {
-  HandleResolveOptions,
-  HandleResolver,
-  ResolvedHandle,
-  isResolvedHandle,
-} from '@atproto-labs/handle-resolver'
-
-const SUBDOMAIN = '_atproto'
-const PREFIX = 'did='
-
-export type DnsHandleResolverOptions = {
-  /**
-   * Nameservers to use in place of the system's default nameservers.
-   */
-  nameservers?: string[]
-}
-
-export class DnsHandleResolver implements HandleResolver {
-  protected resolveTxt: typeof resolveTxt
-
-  constructor(options?: DnsHandleResolverOptions) {
-    this.resolveTxt = options?.nameservers
-      ? buildResolveTxt(options.nameservers)
-      : resolveTxt.bind(null)
-  }
-
-  public async resolve(
-    handle: string,
-    _options?: HandleResolveOptions,
-  ): Promise<ResolvedHandle> {
-    try {
-      return parseDnsResult(await this.resolveTxt(`${SUBDOMAIN}.${handle}`))
-    } catch (err) {
-      return null
-    }
-  }
-}
-
-function buildResolveTxt(nameservers: string[]): typeof resolveTxt {
-  // Build the resolver asynchronously
-  const resolverPromise: Promise<Resolver | null> = Promise.allSettled(
-    nameservers.map((h) => lookup(h)),
-  )
-    .then((responses) =>
-      responses.flatMap((r) =>
-        r.status === 'fulfilled' ? [r.value.address] : [],
-      ),
-    )
-    .then((backupIps) => {
-      if (!backupIps.length) return null
-      const resolver = new Resolver()
-      resolver.setServers(backupIps)
-      return resolver
-    })
-
-  resolverPromise.catch(() => {
-    // Should never happen
-  })
-
-  return async (hostname) => {
-    const resolver = await resolverPromise
-    return resolver ? resolver.resolveTxt(hostname) : []
-  }
-}
-
-function parseDnsResult(chunkedResults: string[][]): ResolvedHandle {
-  const results = chunkedResults.map((chunks) => chunks.join(''))
-  const found = results.filter((i) => i.startsWith(PREFIX))
-  if (found.length !== 1) {
-    return null
-  }
-  const did = found[0].slice(PREFIX.length)
-  return isResolvedHandle(did) ? did : null
-}

package/src/node-handle-resolver.ts

@@ -1,96 +0,0 @@
-import { Fetch } from '@atproto-labs/fetch'
-import { SafeFetchWrapOptions, safeFetchWrap } from '@atproto-labs/fetch-node'
-import {
-  CachedHandleResolver,
-  CachedHandleResolverOptions,
-  HandleResolver,
-  WellKnownHandleResolver,
-} from '@atproto-labs/handle-resolver'
-
-import {
-  DnsHandleResolver,
-  DnsHandleResolverOptions,
-} from './dns-handle-resolver.js'
-
-export type NodeHandleResolverOptions = {
-  /**
-   * List of domain names that are forbidden to be resolved using the
-   * well-known/atproto-did method.
-   */
-  wellKnownExclude?: SafeFetchWrapOptions['forbiddenDomainNames']
-
-  /**
-   * List of backup nameservers to use for DNS resolution.
-   */
-  fallbackNameservers?: DnsHandleResolverOptions['nameservers']
-
-  cache?: CachedHandleResolverOptions['cache']
-
-  /**
-   * Fetch function to use for HTTP requests. Allows customizing the request
-   * behavior, e.g. adding headers, setting a timeout, mocking, etc. The
-   * provided fetch function will be wrapped with a safeFetchWrap function that
-   * adds SSRF protection.
-   *
-   * @default `globalThis.fetch`
-   */
-  fetch?: Fetch
-}
-
-export class NodeHandleResolver
-  extends CachedHandleResolver
-  implements HandleResolver
-{
-  constructor({
-    cache,
-    fetch = globalThis.fetch,
-    fallbackNameservers,
-    wellKnownExclude,
-  }: NodeHandleResolverOptions = {}) {
-    const safeFetch = safeFetchWrap({
-      fetch,
-      timeout: 3000, // 3 seconds
-      forbiddenDomainNames: wellKnownExclude,
-      ssrfProtection: true,
-      responseMaxSize: 10 * 1048, // DID are max 2048 characters, 10kb for safety
-    })
-
-    const httpResolver = new WellKnownHandleResolver({
-      fetch: safeFetch,
-    })
-
-    const dnsResolver = new DnsHandleResolver()
-
-    const fallbackResolver = new DnsHandleResolver({
-      nameservers: fallbackNameservers,
-    })
-
-    super({
-      cache,
-      resolver: {
-        resolve: async (handle) => {
-          const abortController = new AbortController()
-
-          const dnsPromise = dnsResolver.resolve(handle)
-          const httpPromise = httpResolver.resolve(handle, {
-            signal: abortController.signal,
-          })
-
-          // Will be awaited later
-          httpPromise.catch(() => {})
-
-          const dnsRes = await dnsPromise
-          if (dnsRes) {
-            abortController.abort()
-            return dnsRes
-          }
-
-          const res = await httpPromise
-          if (res) return res
-
-          return fallbackResolver.resolve(handle)
-        },
-      },
-    })
-  }
-}